Castle Defense
30 Apr 2025 - joe
Castle Defense: The Dark Siege
A Medieval-Themed Cybersecurity Tabletop Exercise
Exercise Overview
Title: Castle Defense: The Dark Siege
Duration: 4 hours (recommended)
Target Audience: Royal Guards, Court Wizards, Kingdom Scouts, Royal Advisors
Difficulty: Page to Knight Commander-level
Objective: Test the kingdom’s ability to defend against a coordinated siege that combines traditional warfare, sabotage, and dark magic to compromise castle defenses and overthrow the monarchy.
Learning Objectives
- Evaluate team coordination across different defensive specialties
- Test detection capabilities for insider threats and subversion
- Assess communications during rapidly escalating crisis scenarios
- Practice decision-making when facing multi-vector attacks
- Identify gaps in defensive measures and contingency planning
Exercise Structure
Preparation Phase (2 weeks prior)
- Siege Master Selection: Appoint 1-2 individuals to coordinate the exercise
- Defender Selection: Identify key personnel from guard, magic, and intelligence divisions
- Resource Preparation: Ready necessary maps, communication methods, and simulated castle environment
- Pre-Exercise Briefing: Conduct a briefing explaining exercise parameters and expectations
Exercise Roles
- Siege Master: Controls exercise flow, introduces scenarios, evaluates responses
- Royal Guards: Personnel responsible for physical castle defense
- Court Wizards: Specialists in detecting and countering magical threats
- Kingdom Scouts: Intelligence gatherers who monitor enemy movements
- Royal Advisors: Decision-makers balancing defense with kingdom management
- Observers: Record actions, decisions, and potential improvements
- Allied Kingdom Representatives: (Optional) Add complexity with requests for aid
Exercise Materials
Required Documentation
- Castle defense protocols
- Rapid response procedures
- Intelligence assessment guidelines
- Crisis command procedures
- Kingdom resource inventory
- Exercise evaluation metrics
Technical Setup (Optional)
- Castle map with movable tokens
- Communication relays (simulated messenger birds)
- Simulated threat indicators (scrolls, artifacts)
- Crisis war room
Scenario Background
The Kingdom of Brightstone guards the eastern borders of the civilized realms, with Castle Brightstone serving as its formidable center of military power and governance. The castle’s defenses include:
- Outer Bailey Fortifications (first line of physical defense)
- Inner Keep Defenses (secondary defensive position)
- Royal Vault Protection (securing critical assets)
- Kingdom Warning Network (intelligence gathering and alerts)
The kingdom uses a sophisticated defensive system combining military strength, magical wards, and an intelligence network of scouts and informants.
Exercise Narrative
The neighboring Dark Empire has launched a campaign to seize control of Brightstone, using a combination of conventional forces, magical subversion, and infiltration. Their strategy involves weakening the castle from within before the main attack, using agents who have been in place for months. The exercise will test detection and response to this multi-faceted siege scenario.
Exercise Timeline and Scenarios
Phase 1: Subtle Warnings (0:00-1:00)
Setting the Scene (0:00-0:10)
- Siege Master introduces the scenario as a regular day in Brightstone Castle
- Teams are performing routine duties with no indication of imminent threat
- Recent reports mention increased activity in Dark Empire territories
Scenario 1 (0:10): Border Patrol Discrepancies
- Scout reports from eastern border show unusual discrepancies
- Several patrol units failed to report at scheduled times
- When contact is reestablished, scouts claim all is normal, but use slightly incorrect code phrases
- Pattern suggests potential compromise of border scouts
Expected Actions:
- Document and analyze reporting anomalies
- Dispatch trusted scouts to verify border situations
- Review recent intelligence for any corroborating indicators
- Begin quiet preparation of border defenses
Scenario 2 (0:30): Castle Supply Concerns
- Castle quartermaster reports subtle anomalies in recent supply deliveries
- Several shipments contained less than documented amounts
- Some food stores show signs of unusual spoilage
- Key weapon supplies (arrows, oil) are below expected inventory
Expected Actions:
- Investigate supply chain for potential tampering
- Secure remaining critical supplies
- Implement additional verification for incoming deliveries
- Begin assessment of operational readiness given supply constraints
Scenario 3 (0:45): Unusual Guard Behaviors
- Captain of the Guard reports concerning patterns among certain guards
- Several guards have requested unusual post changes
- Some night guards report unexplained fatigue and memory gaps
- Pattern of absences creates periodic security gaps around eastern ramparts
Expected Actions:
- Quietly investigate affected guards
- Adjust rotation to ensure critical posts are covered by trusted personnel
- Request magical screening for enchantment or manipulation
- Begin enhanced monitoring of potentially compromised areas
Phase 2: Escalation (1:00-2:00)
Scenario 4 (1:00): Dark Magic Detected
- Court wizards detect traces of forbidden magic within the castle walls
- The magic signature matches known Dark Empire techniques
- Energy patterns suggest scrying and subversion spells
- Magical traces are strongest near critical defensive positions
Expected Actions:
- Activate magical countermeasures and wards
- Begin systematic search for magical focus objects or infiltrators
- Reinforce key positions with magical protections
- Brief royal advisors on magical threat evidence
Scenario 5 (1:20): Sabotage Discovered
- Guards discover subtle sabotage to castle defenses
- Portcullis mechanisms have been damaged to prevent full closure
- Arrow loops in eastern tower have been subtly widened to allow enemy fire
- Evidence of attempted poisoning in one of the well water supplies
Expected Actions:
- Initiate full security sweep of all defensive systems
- Begin emergency repairs of critical defenses
- Implement backup defensive measures where repairs cannot be completed quickly
- Increase guard presence at vulnerable points
Scenario 6 (1:40): Civilian Unrest
- Reports arrive of unusual unrest in the castle town
- Several tavern gatherings have turned hostile toward the crown
- Merchants are suddenly raising prices, claiming supply issues
- Evidence suggests coordinated spread of anti-monarchy rumors
Expected Actions:
- Dispatch trusted agents to assess civilian situation
- Identify sources of disinformation
- Consider addressing legitimate concerns to maintain public support
- Prepare for possible civilian complications during siege
Phase 3: Crisis Management (2:00-3:00)
Scenario 7 (2:00): Enemy Forces Detected
- Scouts report large Dark Empire forces approaching from the east
- Initial estimates indicate a force significantly larger than intelligence suggested
- Enemy formations include siege engines, infantry, and cavalry
- Magical signatures indicate battle mages among the attacking forces
Expected Actions:
- Sound kingdom-wide alerts
- Activate full defensive posture
- Recall all available forces to defensive positions
- Dispatch emergency messages to potential allies
Scenario 8 (2:20): Royal Decision Point
- The monarch requires immediate counsel on defensive strategy
- Options include full castle defense, tactical withdrawal, or counterattack
- Intelligence suggests enemy may have unexpected capabilities
- Decisions must account for compromised positions and supplies
Expected Actions:
- Present objective assessment of defensive capabilities
- Provide clear strategic options with risks and benefits
- Recommend course of action based on kingdom priorities
- Begin implementation of royal decisions
Scenario 9 (2:40): Multiple Front Attack
- Dark Empire forces begin coordinated attack on multiple fronts
- Eastern walls face conventional siege warfare
- Northern gate experiences unexpected attack suggesting insider knowledge
- Magical assault attempts to disable key defensive enchantments
- Fires erupt in lower town, drawing attention and resources
Expected Actions:
- Implement resource prioritization for multiple threats
- Coordinate physical and magical defenses
- Identify and isolate suspected insider threats
- Maintain command and control during chaos
Phase 4: Resolution and Recovery (3:00-4:00)
Scenario 10 (3:00): Critical Vulnerability
- Defense assessment reveals critical vulnerability in castle defenses
- Analysis confirms it resulted from long-term sabotage and planning
- Enemy forces are positioned to exploit this weakness
- Conventional defenses alone cannot prevent breach
Expected Actions:
- Develop emergency countermeasures for the vulnerability
- Reallocate resources to reinforce the vulnerable position
- Implement deception measures to mislead enemy about awareness
- Prepare secondary defensive positions in case of breach
Scenario 11 (3:20): Turning Point Decision
- Defenders identify opportunity to counter enemy strategy
- Options include revealing enemy infiltrators, magical counterstrike, or diplomatic gambit
- Each option requires committing limited resources
- Decision must account for both immediate battle and long-term kingdom security
Expected Actions:
- Evaluate strategic options against kingdom objectives
- Make recommendations based on careful risk assessment
- Implement chosen strategy with clear communication
- Adapt plans as situation evolves
Scenario 12 (3:40): Aftermath Planning
- With immediate crisis managed, focus shifts to kingdom security
- Extent of infiltration suggests long-term security concerns
- Damage to castle defenses requires significant repairs
- Civilian population needs reassurance and support
Expected Actions:
- Develop prioritized recovery plan
- Establish enhanced security protocols to prevent further infiltration
- Create communication strategy for nobles and commoners
- Begin documenting lessons for future kingdom defense
Conclusion (3:50-4:00)
- Siege Master declares the end of the exercise
- Brief initial feedback from participants
- Schedule formal debrief session for the following day
Exercise Evaluation
Evaluation Metrics
- Detection Effectiveness
- Time to identify subtle warning indicators
- Ability to connect disparate threat indicators
- Success in identifying infiltrators and sabotage
- Response Efficiency
- Speed of appropriate defensive actions
- Resource allocation during multiple threats
- Coordination between different defensive specialties
- Command Effectiveness
- Clarity of orders and communications
- Decision-making under pressure
- Strategic thinking beyond immediate tactical concerns
- Kingdom Protection
- Protection of critical castle assets and personnel
- Maintenance of defensive capability during crisis
- Minimization of civilian impacts
Post-Exercise Activities
- War Council Debrief (Immediately following exercise)
- Initial impressions from key participants
- Identification of critical vulnerabilities or successes
- Immediate action items for critical weaknesses
- Formal Strategic Review (1-2 days after exercise)
- Detailed analysis of decision points and outcomes
- Assessment of kingdom readiness for similar threats
- Documentation of lessons learned
- Defense Enhancement Planning (1-2 weeks after exercise)
- Development of improved defensive protocols
- Assignment of responsibilities for security improvements
- Resource allocation for critical upgrades
- Training Adjustments (Ongoing)
- Modification of guard training to address weaknesses
- Enhancement of wizard countermeasures against dark magic
- Improvement of scout procedures for threat detection
Siege Master Guidelines
Pre-Exercise Preparation
- Scenario Customization
- Adjust threat details to match your kingdom’s specific geopolitical situation
- Modify enemy tactics based on known regional threats
- Ensure scenarios test key defensive capabilities
- Information Management
- Prepare intelligence reports with varying levels of clarity and reliability
- Create visual aids for enemy movements and castle defenses
- Develop role-specific information for different defensive specialties
- Environment Setup
- Arrange exercise space to simulate castle command structure
- Consider using colored banners/flags to indicate threat levels
- Prepare method for tracking resource allocation and casualties
During Exercise Facilitation
- Maintaining Realism
- Introduce fog of war and information uncertainty
- Ensure consequences follow logically from defender decisions
- Balance between overwhelming force and winnable scenarios
- Adaptability
- Adjust enemy tactics based on defender actions
- Scale challenge level if defenders are struggling or succeeding easily
- Be prepared to introduce unexpected complications to test flexibility
- Observation
- Note key decisions and their justifications
- Identify communication breakdowns or successes
- Document innovative strategies for future training
Post-Exercise Activities
- Leading Effective Debriefs
- Begin with positive observations before addressing weaknesses
- Focus on systemic issues rather than individual mistakes
- Encourage defenders to evaluate their own performance
- Documentation
- Create comprehensive record of exercise events and decisions
- Compare performance against established kingdom defense standards
- Develop specific, actionable recommendations
Appendix: Detailed Siege Scenarios
Border Patrol Anomalies
- Affected Regions: Eastern Ridge, Blackwood Pass, Rivermeet Crossing
- Compromised Units: 3rd Scout Division, River Watch, Eastern Outriders
- Compromise Method: Combination of bribery, replacement, and magical compulsion
- Duration: Infiltration began approximately three months before exercise
- Detection Clues: Slightly delayed reports, minor terminology errors, inconsistent patrol patterns
Dark Magic Signatures
- Magic Types: Scrying, Compulsion, Illusion, Corruption
- Casting Methods: Blood magic focus objects, long-duration ritual spells, bound spirits
- Detection Challenges: Spells designed to avoid conventional magical wards
- Affected Areas: Eastern guard quarters, well house, armory, main gate mechanisms
- Countermeasures: Purification rituals, counter-scrying wards, protective amulets
Enemy Force Composition
- Infantry: 1,200 heavy infantry with siege training
- Cavalry: 300 mounted knights with anti-fortress equipment
- Siege Engines: 4 trebuchets, 6 battering rams, 12 scaling towers
- Magical Support: 8 battle mages, 3 senior dark wizards
- Special Units: Tunnel teams, gate breakers, anti-magic specialists
- Command Structure: Decentralized with multiple field commanders to resist decapitation strikes
Insider Threat Analysis
- Infiltrator Positions: 2 guards, 1 cook, 1 stable master, 1 junior wizard
- Recruitment Methods: Combination of blackmail, financial incentives, and magical compulsion
- Operational Duration: Longest-placed agent active for two years
- Key Intelligence Compromised: Guard rotations, defensive enchantment locations, supply levels
- Communication Methods: Encoded messages in merchant shipments, magical dream communication